Unit 4: TCP, UDP and ports · Lesson 1 of 6 · 15 min
TCP and UDP
Compare the two transport protocols and see which one carries which traffic.
mission
- You are
- The analyst writing firewall rules for the DNS team.
- Situation
- The DNS team asked for port 53 to be opened, but did not say whether they need TCP, UDP or both.
- Goal
- Show which transport the office's lookups use and why both exist.
- Hand in
- The protocol and port carrying the queries in dns.pcap.
TCP and UDP side by side
| Command | What it does |
|---|---|
TCP | Connection first, ordered, retransmits. Web, mail, SSH |
UDP | No connection, no ordering, no retries. DNS, time sync, video calls, QUIC |
ip.proto 6 | The IP header's way of saying TCP follows |
ip.proto 17 | The IP header's way of saying UDP follows |
A DNS question, wrapped
Each step wraps the data in one more header, the way a sender builds a packet.
Check the protocol number
The IP header names the transport inside it. 6 is TCP, 17 is UDP.
tshark -r layers.pcap -c 1 -T fields -e ip.proto -e tcp.dstport 6 80 tshark -r dns.pcap -c 2 -T fields -e frame.protocols eth:ethertype:ip:udp:dns eth:ethertype:ip:udp:dns
you should see The web request rides on TCP, the DNS lookups on UDP.
tshark- The command-line version of Wireshark. Reads captures and filters packets by protocol fields. Install with sudo apt install tshark, or brew install wireshark on a Mac.
Look up well-known ports
/etc/services maps port numbers to service names. It is a convention, not a rule.
grep -E '^(domain|http|https|ssh)\s' /etc/services
ssh 22/tcp # SSH Remote Login Protocol
domain 53/tcp # Domain Name Server
domain 53/udp
http 80/tcp www # WorldWideWeb HTTP
https 443/tcp # http protocol over TLS/SSL
https 443/udp # HTTP/3
you should see DNS is listed for both TCP and UDP, and HTTPS now uses UDP too, for HTTP/3.
defender tip Answer the DNS team with both: UDP 53 for normal lookups, TCP 53 for large answers and zone transfers, and only to the DNS servers.
grep- Prints the lines of text that match a pattern. Built into Linux and macOS.
Count TCP and UDP in a real capture
Protocol 6 is TCP and 17 is UDP.
tshark -r incident.pcap -T fields -e ip.proto | sort | uniq -c
32 17
818 6
you should see 818 TCP packets and 32 UDP packets, almost all of them DNS.
sort- Sorts lines of text. Built into Linux and macOS.
uniq- Collapses repeated neighbouring lines. With -c it counts them. Built into Linux and macOS.
See which UDP service was used
UDP traffic on an office network is mostly DNS. Anything else deserves a name.
tshark -r incident.pcap -Y 'udp && !(udp.port==53)' | wc -l
0
you should see Zero UDP packets that are not DNS.
wc- Counts lines, words and bytes. Built into Linux and macOS.
What a defender takes away
- 1TCP for conversations that must arrive whole, UDP for quick questions and live media.
- 2A port number is a convention. Check what actually answers.
- 3HTTP/3 runs over UDP 443, so blocking only TCP 443 no longer blocks the web.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.